OpenWhistle

Overview

OpenWhistle is open-source whistleblowing software for organisations that need an internal reporting channel aligned with EU Directive 2019/1937 and Germany’s HinSchG. It best suits teams able to operate software on their own infrastructure and manage reporting without paid vendor support. Its privacy-focused reporting and follow-up are compelling; the self-hosting requirement makes it a poor fit for organisations seeking a ready-hosted service.

Key features

Reporters submit a case without creating an account or providing an email address, then receive a case number and UUID4 PIN. They use those credentials to return to a status page, read replies and send follow-up messages. That creates a two-way channel without tying a report to a reporter’s account.

Confidential mode adds a controlled route for identifying a reporter: their name and contact details are encrypted and become visible to the case handler only after an audited reason. This is useful when a process needs a way to contact or identify a reporter while limiting routine access to that information.

Admin sign-in supports passwords, LDAP or OIDC, and always requires TOTP. LDAP and external OIDC can connect authentication to an organisation’s existing identity provider. Attachments can optionally be scanned with ClamAV. The interface supports English, German, French and Brazilian Portuguese.

The maker says no IP address is stored at any layer, and outbound requests are opt-in and off by default. Closed reports are deleted after 1,095 days by default. Those defaults support a privacy-conscious setup, but organisations still need to assess whether the retention period and their own configuration suit their obligations.

Pricing

Free: free. There is no paid tier or subscription; the organisation pays for its own server. The free plan includes anonymous reporting, workflow automation and single sign-on. It is the natural fit for organisations that can supply and maintain hosting themselves. There is no free trial because the software is free, but there is also no hosted option or paid support tier to turn to for vendor-operated service.

The main cost trade-off is operational rather than a subscription: deployment and server costs sit with the organisation. Support is through GitHub Issues, so teams that need a paid support commitment should look elsewhere.

Platforms

OpenWhistle supports Linux and web use and is self-hosted. Deployment is on an organisation’s own server using Docker Compose or a Helm chart; the project does not provide a hosted service. That suits teams with infrastructure capacity, but rules it out for buyers who require a managed cloud product.

Who it's for

The maker targets companies and public bodies covered by EU Directive 2019/1937 and Germany’s HinSchG, including companies with 50 employees and financial firms. Its open-source GPL v3.0 licence and self-hosting model make it a reasonable candidate for organisations that want control over deployment and can operate the system internally. Smaller teams without server administration capacity, or organisations that require contracted support, may find the operating model a more significant burden than the free price suggests.

Pros and cons

• Pros: Anonymous submission and PIN-based follow-up allow two-way reporting without requiring reporter accounts or email addresses.
• Pros: Confidential mode encrypts identity details and gates case-handler access behind an audited reason.
• Pros: LDAP/OIDC authentication, mandatory TOTP, optional ClamAV scanning and four interface languages address concrete operational needs.
• Pros: The free, open-source plan has no subscription, and the maker says IP addresses are not stored at any layer.
• Cons: Organisations must host and maintain the service themselves; there is no hosted service.
• Cons: There is no paid support tier, leaving GitHub Issues as the maker’s support route.
• Cons: Closed reports are deleted after 1,095 days by default, a retention setting organisations should assess against their own requirements.

Alternatives

For a broader comparison, see Whistleblower Hotline Software.

GlobaLeaks is another free, self-hosted open-source option for Linux and web, with API support. Its default attachment limit is 30MB per file and can be configured higher; consider it if that attachment limit and deployment profile better match your needs.

BoardEffect is a paid alternative for buyers seeking Android, iOS, web and API platforms; pricing is available by demo request.

NotMe offers Android, iOS, web and API platforms. Its NotMe Platform costs $99 a month based on employee count and includes unlimited reports with up to 5–10 admin licenses; choose it if those terms suit your team and a paid platform is preferable.

iVoiceUp is a paid web alternative with plans that specify different admin-account counts and, at Professional, automated routing and escalation paths.

NAVEX One is a paid web and API option with pricing tailored to organisation size, selected solutions, program scope and requirements; bundled NAVEX solutions can save up to 30%.

Ethics Suite is a paid web alternative.

Rezilens is a paid alternative.

WrightLine is a paid web alternative.

Verdict

Choose OpenWhistle if your organisation needs an internal whistleblowing channel, values anonymous two-way reporting and confidential identity handling, and has the capacity to host and maintain open-source software. Its strongest case is the combination of privacy controls and a free, self-hosted model. Look elsewhere if you need vendor-hosted deployment or paid support.